If “Identity Management is a Pain in the Backside” is Identity Analytics the Cure?

I fully agree with the content of this article, called “Identity management is a pain in the backside”.

The IAM area is complex. It requires huge investments (often millions of $) and usually it ends up with expensive deployed IAM solutions that only partially address the needs and mitigate the risk exposure of organisations.

In particular the provisioning and deprovisioning processes are critical as they expose organisations at many security risks. I have been hearing this message from many customers.

Part of the problem is that it is difficult, even for expert decision makers, to understand what the implications (and the impact) are of making decisions and investments in IAM. Various aspects should to be taken into account, including the relevant IAM and business processes, people behaviours, the threat environment, current IT infrastructure and systems, etc.

This is why at HP Labs are exploring approaches to address this type of issues, broadly in the context of security and, more specifically, in the context of IAM.

Our HP Labs Security and Identity Analytics methodology (and modelling & simulation tools) has already been validated in a few core case studies with customers from the financial and government environment.
I would like to remind that this Security and Identity Analytics approach is a top-down approach, based on a rigorous scientific methodology, to provide decision support to strategic decision makers: modelling and simulation techniques are applied to represent the involved processes, IT systems, people behaviours and threats. What-if analysis is carried out to explore options. This is different from more traditional bottom-up analytic approaches, aiming at providing support by analysing and correlating wide sets of low-level data.
As discussed in this blog post of mine, I am interested in applying Identity Analytics in a few additional case studies with customers.

Thanks to the many organisations and people that have already stated their interest in engaging in a case study. I am planning to wait 1-2 additional weeks and then I’ll choose 1-2 companies to start engaging with.


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---